Loading vulnerability…
OS Command Injection in systeminformation fsSize() on Windows
CVE-2025-68154 is an OS command injection vulnerability in the Node.js systeminformation library affecting versions prior to 5.27.14 on Windows systems. The flaw is in the fsSize() function, where the optional drive parameter is concatenated directly into a PowerShell command without proper sanitization or validation. If an application passes attacker-controlled input to this parameter, an attacker can inject additional commands and cause arbitrary command execution in the context of the Node.js process. The vulnerability is application-dependent: deployments that do not expose user-controlled input to fsSize() are not exploitable through this issue.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary operating system command execution on affected Windows hosts with the privileges of the application process invoking systeminformation. Depending on the privileges and surrounding environment, this can enable full compromise of the application context, access to sensitive data, execution of follow-on payloads, service disruption, lateral movement, and broader host takeover.
If you can’t patch tonight, do this now.
Until patched versions are deployed, prevent untrusted or externally influenced input from reaching fsSize(). Restrict acceptable values for the drive parameter to a strict allowlist of expected drive identifiers, reject unexpected characters and metacharacters, and avoid constructing workflows that let remote users choose arbitrary drive strings. Additional hardening includes running the Node.js service with least privilege and limiting its ability to spawn or abuse system command execution paths.
Patch, then assume compromise.
Upgrade systeminformation to version 5.27.14 or later, which contains the vendor patch for this issue. Review all application code paths that call fsSize() and ensure untrusted input is not passed directly into the drive parameter. Where the library is bundled transitively, update the dependent package set or lockfile so the fixed version is actually deployed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.